
 <!DOCTYPE HTML>
<html>
<head><meta name="generator" content="Hexo 3.9.0">
  <meta charset="UTF-8">
  
    <title>K8s RBAC授权初探 | Zong&#39;s blog</title>
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=3, minimum-scale=1">
    
    <meta name="author" content="Zong">
    
    <meta name="description" content="RBAC授权体系RBAC是K8s的一种授权体系，通过角色（role、clusterrole），对象（user、group、sa），绑定关系（rolebinding、clusterrolebinding）三种定义组合去灵活描述对K8s资源的操作权限。K8s还要其他授权模式，默认是AlwaysAllow">
    
    
    
    
    
    <link rel="icon" href="/img/favicon.ico">
    
    
    <link rel="apple-touch-icon" href="/img/pacman.jpg">
    <link rel="apple-touch-icon-precomposed" href="/img/pacman.jpg">
    
    <link rel="stylesheet" href="/css/style.css">
</head>
</html>
  <body>
    <header>
      <div>
		
			<div id="imglogo">
				<a href="/"><img src="/img/logo.svg" alt="Zong&#39;s blog" title="Zong&#39;s blog"/></a>
			</div>
			
			<div id="textlogo">
				<h1 class="site-name"><a href="/" title="Zong&#39;s blog">Zong&#39;s blog</a></h1>
				<h2 class="blog-motto">日常积累，技术分享</h2>
			</div>
			<div class="navbar"><a class="navbutton navmobile" href="#" title="Menu">
			</a></div>
			<nav class="animated">
				<ul>
					<ul>
					 
						<li><a href="/">Home</a></li>
					
						<li><a href="/archives">Archives</a></li>
					
						<li><a href="/categories/运维">运维</a></li>
					
						<li><a href="/categories/容器架构">容器架构</a></li>
					
					<li>
					
					<form class="search" action="//baidu.com/s" method="get" accept-charset="utf-8">
						<label>Search</label>
						<input type="text" id="search" name="wd" autocomplete="off" maxlength="20" placeholder="Search" />
                        <input name=tn type=hidden value="bds">
                        <input name=cl type=hidden value="3">
                        <input name=ct type=hidden value="2097152">
						<input type="hidden" name="si" value="www.lstop.pub">
					</form>
					
					</li>
				</ul>
			</nav>			
</div>

    </header>
    <div id="container">
      <div id="main" class="post" itemscope itemprop="blogPost">
	<article itemprop="articleBody"> 
		<header class="article-info clearfix">
  <h1 itemprop="name">
    
      <a href="/2019/07/22/K8s-RBAC授权初探/" title="K8s RBAC授权初探" itemprop="url">K8s RBAC授权初探</a>
  </h1>
  <p class="article-author">By
    
      <a href="http://www.lstop.pub" title="Zong">Zong</a>
    </p>
  <p class="article-time">
    <time datetime="2019-07-22T07:55:45.000Z" itemprop="datePublished">2019-07-22</time>
    
  </p>
</header>

	<div class="article-content">
		
		
		<div id="toc" class="toc-article">
			<strong class="toc-title">Contents</strong>
		<ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#RBAC授权体系"><span class="toc-number">1.</span> <span class="toc-text">RBAC授权体系</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#角色"><span class="toc-number">1.1.</span> <span class="toc-text">角色</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#对象"><span class="toc-number">1.2.</span> <span class="toc-text">对象</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#绑定关系"><span class="toc-number">1.3.</span> <span class="toc-text">绑定关系</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#使用RBAC"><span class="toc-number">2.</span> <span class="toc-text">使用RBAC</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#kubeconfig授权"><span class="toc-number">2.1.</span> <span class="toc-text">kubeconfig授权</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#SA授权"><span class="toc-number">2.2.</span> <span class="toc-text">SA授权</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#验证"><span class="toc-number">2.2.1.</span> <span class="toc-text">验证</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#踩坑"><span class="toc-number">2.3.</span> <span class="toc-text">踩坑</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#坑1"><span class="toc-number">2.3.1.</span> <span class="toc-text">坑1</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#坑2"><span class="toc-number">2.3.2.</span> <span class="toc-text">坑2</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#坑3"><span class="toc-number">2.3.3.</span> <span class="toc-text">坑3</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#dashboard"><span class="toc-number">3.</span> <span class="toc-text">dashboard</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#后记"><span class="toc-number">4.</span> <span class="toc-text">后记</span></a></li></ol>
		</div>
		
		<h1 id="RBAC授权体系"><a href="#RBAC授权体系" class="headerlink" title="RBAC授权体系"></a>RBAC授权体系</h1><p>RBAC是K8s的一种授权体系，通过角色（role、clusterrole），对象（user、group、sa），绑定关系（rolebinding、clusterrolebinding）三种定义组合去灵活描述对K8s资源的操作权限。<br>K8s还要其他授权模式，默认是AlwaysAllow，还有Node、ABAC等。</p>
<h2 id="角色"><a href="#角色" class="headerlink" title="角色"></a>角色</h2><p>角色有role、clusterrole，主要描述规则和权限，只有授予权限，不能禁止权限，可以通过Role定义在一个命名空间中的角色，或者可以使用ClusterRole定义集群范围的角色。</p>
<h2 id="对象"><a href="#对象" class="headerlink" title="对象"></a>对象</h2><p>对象主要是user、group、serviceaccount三种，其中system:被保留作为用来Kubernetes系统使用，第一次使用RBAC启动apiserver的时候创建，因此不能作为用户的前缀。</p>
<h2 id="绑定关系"><a href="#绑定关系" class="headerlink" title="绑定关系"></a>绑定关系</h2><p>把角色和对象绑定，就能描述user能做什么，sa能做什么，完成整个授权动作</p>
<p>更具体的操作可以参考网上资料：<br><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" target="_blank" rel="noopener">Using RBAC Authorization</a><br><a href="https://mritd.me/2017/07/17/kubernetes-rbac-chinese-translation/" target="_blank" rel="noopener">Kubernetes RBAC</a><br><a href="https://juejin.im/entry/5b23280ce51d4558cd2acdea" target="_blank" rel="noopener">Kubernetes-基于RBAC的授权</a></p>
<h1 id="使用RBAC"><a href="#使用RBAC" class="headerlink" title="使用RBAC"></a>使用RBAC</h1><p>RBAC在1.8版已经稳定，使用rbac.authorization.k8s.io/v1 API进行定义，启用RBAC需要在apiserver启动时指定参数</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">--authorization-mode=RBAC</span><br></pre></td></tr></table></figure>

<h2 id="kubeconfig授权"><a href="#kubeconfig授权" class="headerlink" title="kubeconfig授权"></a>kubeconfig授权</h2><p>kubeconfig通常使用x509证书认证访问apiserver，k8s会读取证书的CN作为user，O作为group<br>下面给一个例子，用这个json生成的x509证书，其中system:kube-proxy是user，k8s是group</p>
<figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">&#123;</span><br><span class="line">  <span class="attr">"CN"</span>: <span class="string">"system:kube-proxy"</span>,</span><br><span class="line">  <span class="attr">"hosts"</span>: [],</span><br><span class="line">  <span class="attr">"key"</span>: &#123;</span><br><span class="line">    <span class="attr">"algo"</span>: <span class="string">"rsa"</span>,</span><br><span class="line">    <span class="attr">"size"</span>: <span class="number">2048</span></span><br><span class="line">  &#125;,</span><br><span class="line">  <span class="attr">"names"</span>: [</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="attr">"C"</span>: <span class="string">"CN"</span>,</span><br><span class="line">      <span class="attr">"ST"</span>: <span class="string">"Guangdong"</span>,</span><br><span class="line">      <span class="attr">"L"</span>: <span class="string">"Zhongshan"</span>,</span><br><span class="line">      <span class="attr">"O"</span>: <span class="string">"k8s"</span>,</span><br><span class="line">      <span class="attr">"OU"</span>: <span class="string">"System"</span></span><br><span class="line">    &#125;</span><br><span class="line">  ]</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>给这个x509证书授权可用更新bxr-dev namespace上的deployment的image版本（kubectl set image）</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line">kind: Role</span><br><span class="line">apiVersion: rbac.authorization.k8s.io/v1</span><br><span class="line">metadata:</span><br><span class="line">  name: updateimg</span><br><span class="line">  namespace: bxr-dev</span><br><span class="line">rules:</span><br><span class="line">  - apiGroups: [&quot;extensions&quot;]</span><br><span class="line">    resources: [&quot;deployments&quot;]</span><br><span class="line">    verbs: [&quot;get&quot;,&quot;patch&quot;]</span><br><span class="line">---</span><br><span class="line">kind: RoleBinding</span><br><span class="line">apiVersion: rbac.authorization.k8s.io/v1</span><br><span class="line">metadata:</span><br><span class="line">  name: updateimg</span><br><span class="line">  namespace: bxr-dev</span><br><span class="line">roleRef:</span><br><span class="line">  apiGroup: rbac.authorization.k8s.io</span><br><span class="line">  kind: Role</span><br><span class="line">  name: updateimg</span><br><span class="line">subjects:</span><br><span class="line">- kind: User</span><br><span class="line">  name: system:kube-proxy</span><br></pre></td></tr></table></figure>

<h2 id="SA授权"><a href="#SA授权" class="headerlink" title="SA授权"></a>SA授权</h2><p>下面的yaml描述了readpod sa只能对pods资源进行get、list、watch操作：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line">apiVersion: v1</span><br><span class="line">kind: ServiceAccount</span><br><span class="line">metadata:</span><br><span class="line">  name: readpod</span><br><span class="line">  namespace: bxr-dev</span><br><span class="line">---  </span><br><span class="line">kind: ClusterRole</span><br><span class="line">apiVersion: rbac.authorization.k8s.io/v1</span><br><span class="line">metadata:</span><br><span class="line">  name: readpod</span><br><span class="line">rules:</span><br><span class="line">  - apiGroups: [&quot;&quot;]</span><br><span class="line">    resources: [&quot;pods&quot;]</span><br><span class="line">    verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]</span><br><span class="line">---</span><br><span class="line">kind: ClusterRoleBinding</span><br><span class="line">apiVersion: rbac.authorization.k8s.io/v1</span><br><span class="line">metadata:</span><br><span class="line">  name: readpod </span><br><span class="line">roleRef:</span><br><span class="line">  apiGroup: rbac.authorization.k8s.io</span><br><span class="line">  kind: ClusterRole</span><br><span class="line">  name: readpod</span><br><span class="line">subjects:</span><br><span class="line">- kind: ServiceAccount</span><br><span class="line">  name: readpod</span><br><span class="line">  namespace: bxr-dev</span><br></pre></td></tr></table></figure>

<h3 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h3><p>创建一个测试pod，使用readpod sa</p>
<blockquote>
<p>如果不指定serviceAccountName，默认使用default sa</p>
</blockquote>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line">apiVersion: v1</span><br><span class="line">kind: Pod</span><br><span class="line">metadata:</span><br><span class="line">  name: nettool </span><br><span class="line">  labels:</span><br><span class="line">    role: tools</span><br><span class="line">spec:</span><br><span class="line">  serviceAccountName: readpod </span><br><span class="line">  containers:</span><br><span class="line">  - name: nettool</span><br><span class="line">    image: registry.bxr.cn/nettool:v2</span><br><span class="line">    command:</span><br><span class="line">      - sleep</span><br><span class="line">      - &quot;3600&quot;</span><br></pre></td></tr></table></figure>

<p>访问pod正常：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">TOKEN=`cat /var/run/secrets/kubernetes.io/serviceaccount/token`</span><br><span class="line">curl -H &quot;Authorization: Bearer $TOKEN&quot;  --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt https://kubernetes.default/api/v1/pods</span><br><span class="line">结果太长忽略</span><br></pre></td></tr></table></figure>

<p>访问nodes显示403：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"># curl -H &quot;Authorization: Bearer $TOKEN&quot;  --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt https://kubernetes.default/api/v1/nodes     </span><br><span class="line">&#123;</span><br><span class="line">  &quot;kind&quot;: &quot;Status&quot;,</span><br><span class="line">  &quot;apiVersion&quot;: &quot;v1&quot;,</span><br><span class="line">  &quot;metadata&quot;: &#123;</span><br><span class="line">    </span><br><span class="line">  &#125;,</span><br><span class="line">  &quot;status&quot;: &quot;Failure&quot;,</span><br><span class="line">  &quot;message&quot;: &quot;nodes is forbidden: User \&quot;system:serviceaccount:bxr-dev:readpod\&quot; cannot list resource \&quot;nodes\&quot; in API group \&quot;\&quot; at the cluster scope&quot;,</span><br><span class="line">  &quot;reason&quot;: &quot;Forbidden&quot;,</span><br><span class="line">  &quot;details&quot;: &#123;</span><br><span class="line">    &quot;kind&quot;: &quot;nodes&quot;</span><br><span class="line">  &#125;,</span><br><span class="line">  &quot;code&quot;: 403</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h2 id="踩坑"><a href="#踩坑" class="headerlink" title="踩坑"></a>踩坑</h2><p>我们的环境之前没有做RBAC，一直是AlwaysAllow，不知是不是这个原因，配置RBAC遇到一些问题，下面记录一下</p>
<h3 id="坑1"><a href="#坑1" class="headerlink" title="坑1"></a>坑1</h3><p>第一次配置碰到启用RBAC后node节点不能获取权限的报错：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">E0722 14:26:55.781794    7156 kubelet.go:2266] node &quot;k8s-dev-node2&quot; not found</span><br><span class="line">E0722 14:26:55.882538    7156 kubelet.go:2266] node &quot;k8s-dev-node2&quot; not found</span><br><span class="line">E0722 14:26:55.956837    7156 reflector.go:134] k8s.io/kubernetes/pkg/kubelet/kubelet.go:444: Failed to list *v1.Service: services is forbidden: User &quot;system:node:k8s-dev-node2&quot; cannot list resource &quot;services&quot; in API group &quot;&quot; at the cluster scope</span><br><span class="line">E0722 14:26:55.956991    7156 reflector.go:134] k8s.io/kubernetes/pkg/kubelet/config/apiserver.go:47: Failed to list *v1.Pod: pods is forbidden: User &quot;system:node:k8s-dev-node2&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; at the cluster scope</span><br><span class="line">E0722 14:26:55.957667    7156 reflector.go:134] k8s.io/kubernetes/pkg/kubelet/kubelet.go:453: Failed to list *v1.Node: nodes &quot;k8s-dev-node2&quot; is forbidden: User &quot;system:node:k8s-dev-node2&quot; cannot list resource &quot;nodes&quot; in API group &quot;&quot; at the cluster scope</span><br><span class="line">E0722 14:26:55.983322    7156 kubelet.go:2266] node &quot;k8s-dev-node2&quot; not found</span><br></pre></td></tr></table></figure>

<p>解决方法是添加group到system:nodes绑定：</p>
<blockquote>
<p><a href="https://github.com/kubernetes/kops/issues/3551" target="_blank" rel="noopener">https://github.com/kubernetes/kops/issues/3551</a></p>
</blockquote>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl set subject clusterrolebinding system:node --group=system:nodes</span><br></pre></td></tr></table></figure>

<h3 id="坑2"><a href="#坑2" class="headerlink" title="坑2"></a>坑2</h3><p>重启容器时报错:</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">Events:</span><br><span class="line">  Type     Reason                  Age               From                    Message</span><br><span class="line">  ----     ------                  ----              ----                    -------</span><br><span class="line">  Normal   Scheduled               21s               default-scheduler       Successfully assigned bxr-dev/nginx-static-6s578 to k8s-dev-node2</span><br><span class="line">  Warning  FailedCreatePodSandBox  20s               kubelet, k8s-dev-node2  Failed create pod sandbox: rpc error: code = Unknown desc = failed to set up sandbox container &quot;872e50de75eabb3754b5abdd0fe1d8c85f97af82c278e26b3b1b40760a1032cf&quot; network for pod &quot;nginx-static-6s578&quot;: NetworkPlugin cni failed to set up pod &quot;nginx-static-6s578_bxr-dev&quot; network: pods &quot;nginx-static-6s578&quot; is forbidden: User &quot;system:kube-proxy&quot; cannot get resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;bxr-dev&quot;</span><br><span class="line">  Warning  FailedCreatePodSandBox  18s               kubelet, k8s-dev-node2  Failed create pod sandbox: rpc error: code = Unknown desc = failed to set up sandbox container &quot;d5a46e02c897a50a959d1b98a593f253fcce4a824808af62300f9d8a3b2cd852&quot; network for pod &quot;nginx-static-6s578&quot;: NetworkPlugin cni failed to set up pod &quot;nginx-static-6s578_bxr-dev&quot; network: pods &quot;nginx-static-6s578&quot; is forbidden: User &quot;system:kube-proxy&quot; cannot get resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;bxr-dev&quot;</span><br></pre></td></tr></table></figure>

<p>user system:kube-proxy绑定clusterrole system:node-proxier<br>解决方法是添加get pods权限给system:node-proxier clusterrole</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">- apiGroups:</span><br><span class="line">  - &quot;&quot;</span><br><span class="line">  resources:</span><br><span class="line">  - pods</span><br><span class="line">  verbs:</span><br><span class="line">  - get</span><br></pre></td></tr></table></figure>

<h3 id="坑3"><a href="#坑3" class="headerlink" title="坑3"></a>坑3</h3><p>过了一段时间kubelet重启失败，自动续签证书的坑：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">F1113 18:34:54.883386   26329 server.go:261] failed to run Kubelet: cannot create certificate signing request: certificatesigningrequests.certificates.k8s.io is forbidden: User &quot;kubelet-bootstrap&quot; cannot create resource &quot;certificatesigningrequests&quot; in API group &quot;certificates.k8s.io&quot; at the cluster scope</span><br></pre></td></tr></table></figure>

<p>解决方法：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrap</span><br></pre></td></tr></table></figure>

<h1 id="dashboard"><a href="#dashboard" class="headerlink" title="dashboard"></a>dashboard</h1><p>打开rbac后，kubernetes dashboard就需要登录才能使用了，可以选择令牌方式登录，令牌就用admin sa，也可以自己根据权限新建一个sa和role绑定</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line">ubuntu@k8s-m1:~/k8s$ kubectl get sa -n kube-system</span><br><span class="line">NAME                         SECRETS   AGE</span><br><span class="line">admin                        1         480d</span><br><span class="line"></span><br><span class="line">ubuntu@k8s-m1:~/k8s$ kubectl -n kube-system get secret</span><br><span class="line">NAME                                     TYPE                                  DATA   AGE</span><br><span class="line">admin-token-xjlwp                        kubernetes.io/service-account-token   3      479d</span><br><span class="line"></span><br><span class="line">kubectl -n kube-system describe secret admin-token-xjlwp</span><br><span class="line">Name:         admin-token-xjlwp</span><br><span class="line">Namespace:    kube-system</span><br><span class="line">Labels:       &lt;none&gt;</span><br><span class="line">Annotations:  kubernetes.io/service-account.name: admin</span><br><span class="line">              kubernetes.io/service-account.uid: 9ba77c46-5f30-11e8-b2c9-525400dbc2de</span><br><span class="line"></span><br><span class="line">Type:  kubernetes.io/service-account-token</span><br><span class="line"></span><br><span class="line">Data</span><br><span class="line">====</span><br><span class="line">ca.crt:     2045 bytes</span><br><span class="line">namespace:  11 bytes</span><br><span class="line">token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3Mi略。。。  这一大串就是令牌</span><br></pre></td></tr></table></figure>

<h1 id="后记"><a href="#后记" class="headerlink" title="后记"></a>后记</h1><p>为什么要打开rbac？因为如果使用AllwaysAllow，任意一个pod都能访问master并操作数据，显然安全性大大降低，所以墙裂建议打开rbac的。</p>
  
	</div>
		<footer class="article-footer clearfix">

  <div class="article-tags">
  
  <span></span> <a href="/tags/K8s/">K8s</a>
  </div>


<div class="article-categories">
  <span></span>
  <a class="article-category-link" href="/categories/容器架构/">容器架构</a>
</div>



<div class="article-share" id="share">

  <div data-url="http://www.lstop.pub/2019/07/22/K8s-RBAC授权初探/" data-title="K8s RBAC授权初探 | Zong&#39;s blog" data-tsina="" class="share clearfix">
  </div>

</div>
</footer>   	       
	</article>
	
<nav class="article-nav clearfix">
 
 <div class="prev" >
 <a href="/2019/08/15/K8s-HPA/" title="K8s HPA">
  <strong>PREVIOUS:</strong><br/>
  <span>
  K8s HPA</span>
</a>
</div>


<div class="next">
<a href="/2019/07/01/docker-registry清理历史镜像/"  title="docker registry清理历史镜像">
 <strong>NEXT:</strong><br/> 
 <span>docker registry清理历史镜像
</span>
</a>
</div>

</nav>

	
</div>  
      <div class="openaside"><a class="navbutton" href="#" title="Show Sidebar"></a></div>

  <div id="toc" class="toc-aside">
  <strong class="toc-title">Contents</strong>
  <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#RBAC授权体系"><span class="toc-number">1.</span> <span class="toc-text">RBAC授权体系</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#角色"><span class="toc-number">1.1.</span> <span class="toc-text">角色</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#对象"><span class="toc-number">1.2.</span> <span class="toc-text">对象</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#绑定关系"><span class="toc-number">1.3.</span> <span class="toc-text">绑定关系</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#使用RBAC"><span class="toc-number">2.</span> <span class="toc-text">使用RBAC</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#kubeconfig授权"><span class="toc-number">2.1.</span> <span class="toc-text">kubeconfig授权</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#SA授权"><span class="toc-number">2.2.</span> <span class="toc-text">SA授权</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#验证"><span class="toc-number">2.2.1.</span> <span class="toc-text">验证</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#踩坑"><span class="toc-number">2.3.</span> <span class="toc-text">踩坑</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#坑1"><span class="toc-number">2.3.1.</span> <span class="toc-text">坑1</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#坑2"><span class="toc-number">2.3.2.</span> <span class="toc-text">坑2</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#坑3"><span class="toc-number">2.3.3.</span> <span class="toc-text">坑3</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#dashboard"><span class="toc-number">3.</span> <span class="toc-text">dashboard</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#后记"><span class="toc-number">4.</span> <span class="toc-text">后记</span></a></li></ol>
  </div>

<div id="asidepart">
<div class="closeaside"><a class="closebutton" href="#" title="Hide Sidebar"></a></div>
<aside class="clearfix">

  
<div class="tagslist">
	<p class="asidetitle">Tags</p>
		<ul class="clearfix">
		
			<li><a href="/tags/Airtest/" title="Airtest">Airtest<sup>1</sup></a></li>
		
			<li><a href="/tags/DNS/" title="DNS">DNS<sup>1</sup></a></li>
		
			<li><a href="/tags/GitLab/" title="GitLab">GitLab<sup>1</sup></a></li>
		
			<li><a href="/tags/K8s/" title="K8s">K8s<sup>8</sup></a></li>
		
			<li><a href="/tags/Linux/" title="Linux">Linux<sup>1</sup></a></li>
		
			<li><a href="/tags/MongoDB/" title="MongoDB">MongoDB<sup>2</sup></a></li>
		
			<li><a href="/tags/OpenWrt/" title="OpenWrt">OpenWrt<sup>1</sup></a></li>
		
			<li><a href="/tags/Python/" title="Python">Python<sup>2</sup></a></li>
		
			<li><a href="/tags/RabbitMQ/" title="RabbitMQ">RabbitMQ<sup>1</sup></a></li>
		
			<li><a href="/tags/calico/" title="calico">calico<sup>1</sup></a></li>
		
			<li><a href="/tags/cdn/" title="cdn">cdn<sup>1</sup></a></li>
		
			<li><a href="/tags/docker/" title="docker">docker<sup>3</sup></a></li>
		
			<li><a href="/tags/docker-registry/" title="docker registry">docker registry<sup>1</sup></a></li>
		
			<li><a href="/tags/elasticsearch/" title="elasticsearch">elasticsearch<sup>3</sup></a></li>
		
			<li><a href="/tags/elk/" title="elk">elk<sup>3</sup></a></li>
		
			<li><a href="/tags/k8s/" title="k8s">k8s<sup>3</sup></a></li>
		
			<li><a href="/tags/kubernetes/" title="kubernetes">kubernetes<sup>1</sup></a></li>
		
			<li><a href="/tags/nginx/" title="nginx">nginx<sup>1</sup></a></li>
		
			<li><a href="/tags/python/" title="python">python<sup>1</sup></a></li>
		
			<li><a href="/tags/tomcat/" title="tomcat">tomcat<sup>1</sup></a></li>
		
		</ul>
</div>


  <div class="linkslist">
  <p class="asidetitle">Links</p>
    <ul>
      <li><a href="http://www.v2ex.com/?r=zong400" target="_blank" title="V2EX">V2EX</a></li>
      <li><a href="http://hexo.io" target="_blank" title="Hexo">Hexo</a></li>
	  <li><a href="https://promotion.aliyun.com/ntms/yunparter/invite.html?userCode=s0bh6uzq" target="_blank" title="阿里云">阿里云</a></li>
	  <li><a href="https://cloud.tencent.com/redirect.php?redirect=1014&cps_key=5bd9deb84d4d9f34b65fb934e12d03e3&from=console" target="_blank" title="腾讯云">腾讯云</a></li>
    </ul>
</div>


</aside>
</div>
    </div>
    <footer><div id="footer" >
	
	
	<div class="social-font" class="clearfix">
		
		
		
		
	</div>
		<p class="copyright">Hosted by <a href="https://pages.coding.me/" target="_blank" title="Coding Pages">Coding Pages</a></p>
		<p class="copyright">Powered by <a href="http://hexo.io" target="_blank" title="hexo">hexo</a> and Theme by <a href="https://github.com/wizicer/iceman" target="_blank" title="Iceman">Iceman</a> © 2020 
		
		<a href="http://www.lstop.pub" target="_blank" title="Zong">Zong</a>
		
		</p>
</div>
</footer>
    <script src="//cdn.staticfile.org/jquery/2.1.0/jquery.min.js"></script>
<script type="text/javascript">
$(document).ready(function(){ 
  $('.navbar').click(function(){
    $('header nav').toggleClass('shownav');
  });
  var myWidth = 0;
  function getSize(){
    if( typeof( window.innerWidth ) == 'number' ) {
      myWidth = window.innerWidth;
    } else if( document.documentElement && document.documentElement.clientWidth) {
      myWidth = document.documentElement.clientWidth;
    };
  };
  var m = $('#main'),
      a = $('#asidepart'),
      c = $('.closeaside'),
      o = $('.openaside');
  $(window).resize(function(){
    getSize(); 
    if (myWidth >= 1024) {
      $('header nav').removeClass('shownav');
    }else
    {
      m.removeClass('moveMain');
      a.css('display', 'block').removeClass('fadeOut');
      o.css('display', 'none');
      
      $('#toc.toc-aside').css('display', 'none');
        
    }
  });
  c.click(function(){
    a.addClass('fadeOut').css('display', 'none');
    o.css('display', 'block').addClass('fadeIn');
    m.addClass('moveMain');
  });
  o.click(function(){
    o.css('display', 'none').removeClass('beforeFadeIn');
    a.css('display', 'block').removeClass('fadeOut').addClass('fadeIn');      
    m.removeClass('moveMain');
  });
  $(window).scroll(function(){
    o.css("top",Math.max(80,260-$(this).scrollTop()));
  });
});
</script>

<script type="text/javascript">
$(document).ready(function(){ 
  var ai = $('.article-content>iframe'),
      ae = $('.article-content>embed'),
      t  = $('#toc'),
      h  = $('article h2')
      ah = $('article h2'),
      ta = $('#toc.toc-aside'),
      o  = $('.openaside'),
      c  = $('.closeaside');
  if(ai.length>0){
    ai.wrap('<div class="video-container" />');
  };
  if(ae.length>0){
   ae.wrap('<div class="video-container" />');
  };
  if(ah.length==0){
    t.css('display','none');
  }else{
    c.click(function(){
      ta.css('display', 'block').addClass('fadeIn');
    });
    o.click(function(){
      ta.css('display', 'none');
    });
    $(window).scroll(function(){
      ta.css("top",Math.max(140,320-$(this).scrollTop()));
    });
  };
});
</script>


<script type="text/javascript">
$(document).ready(function(){ 
  var $this = $('.share'),
      url = $this.attr('data-url'),
      encodedUrl = encodeURIComponent(url),
      title = $this.attr('data-title'),
      tsina = $this.attr('data-tsina');
  var html = [
  '<a href="#" class="overlay" id="qrcode"></a>',
  '<div class="qrcode clearfix"><span>扫描二维码分享到微信朋友圈</span><a class="qrclose" href="#share"></a><strong>Loading...Please wait</strong><img id="qrcode-pic" data-src="http://s.jiathis.com/qrcode.php?url=' + encodedUrl + '"/></div>',
  '<a href="#textlogo" class="article-back-to-top" title="Top"></a>',
  '<a href="https://www.facebook.com/sharer.php?u=' + encodedUrl + '" class="article-share-facebook" target="_blank" title="Facebook"></a>',
  '<a href="#qrcode" class="article-share-qrcode" title="QRcode"></a>',
  '<a href="https://twitter.com/intent/tweet?url=' + encodedUrl + '" class="article-share-twitter" target="_blank" title="Twitter"></a>',
  '<a href="http://service.weibo.com/share/share.php?title='+title+'&url='+encodedUrl +'&ralateUid='+ tsina +'&searchPic=true&style=number' +'" class="article-share-weibo" target="_blank" title="Weibo"></a>',
  '<span title="Share to"></span>'
  ].join('');
  $this.append(html);
  $('.article-share-qrcode').click(function(){
    var imgSrc = $('#qrcode-pic').attr('data-src');
    $('#qrcode-pic').attr('src', imgSrc);
    $('#qrcode-pic').load(function(){
        $('.qrcode strong').text(' ');
    });
  });
});     
</script>









  </body>
</html>

